From 8e4c0c11a40b1604ea6519d50ae80568eeaa9f91 Mon Sep 17 00:00:00 2001
From: Serge Rider <serge@jkiss.org>
Date: Wed, 25 Oct 2023 17:17:42 +0200
Subject: [PATCH] dbeaver/pro#1978 SSO sign out (#2032)

---
 .../security/CBEmbeddedSecurityController.java   | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java b/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java
index 5e53e4c5df..592892804f 100644
--- a/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java
+++ b/server/bundles/io.cloudbeaver.service.security/src/io/cloudbeaver/service/security/CBEmbeddedSecurityController.java
@@ -1323,17 +1323,19 @@ public class CBEmbeddedSecurityController<T extends WebAuthApplication>
                 if (SMAuthProviderFederated.class.isAssignableFrom(authProviderInstance.getClass())) {
                     //async auth
                     var authProviderFederated = (SMAuthProviderFederated) authProviderInstance;
-                    var redirectUrl = buildRedirectLink(authProviderFederated.getSignInLink(authProviderConfigurationId, Map.of()),
+                    String signInLink = buildRedirectLink(authProviderFederated.getSignInLink(authProviderConfigurationId, Map.of()),
                         authAttemptId);
+                    String signOutLink = authProviderFederated.getSignOutLink(authProviderConfigurationId, Map.of());
                     Map<SMAuthConfigurationReference, Object> authData = Map.of(new SMAuthConfigurationReference(authProviderId,
                         authProviderConfigurationId), filteredUserCreds);
-                    return SMAuthInfo.inProgress(authAttemptId, redirectUrl, authData);
+                    return SMAuthInfo.inProgress(authAttemptId, signInLink, signOutLink, authData);
                 }
                 txn.commit();
                 return finishAuthentication(
                     SMAuthInfo.inProgress(
                         authAttemptId,
                         null,
+                        null,
                         Map.of(new SMAuthConfigurationReference(authProviderId, authProviderConfigurationId), securedUserIdentifyingCredentials)
                     ),
                     true,
@@ -1526,7 +1528,8 @@ public class CBEmbeddedSecurityController<T extends WebAuthApplication>
                 }
             }
             Map<SMAuthConfigurationReference, Object> authData = new LinkedHashMap<>();
-            String redirectUrl = null;
+            String signInLink = null;
+            String signOutLink = null;
 
             try (PreparedStatement dbStat = dbCon.prepareStatement(
                 database.normalizeTableNames(
@@ -1545,7 +1548,10 @@ public class CBEmbeddedSecurityController<T extends WebAuthApplication>
                             WebAuthProviderDescriptor authProviderDescriptor = getAuthProvider(authProviderId);
                             var authProviderInstance = authProviderDescriptor.getInstance();
                             if (SMAuthProviderFederated.class.isAssignableFrom(authProviderInstance.getClass())) {
-                                redirectUrl = buildRedirectLink(((SMAuthProviderFederated) authProviderInstance).getRedirectLink(
+                                signInLink = buildRedirectLink(((SMAuthProviderFederated) authProviderInstance).getRedirectLink(
+                                    authProviderConfiguration,
+                                    Map.of()), authId);
+                                signOutLink = buildRedirectLink(((SMAuthProviderFederated) authProviderInstance).getSignOutLink(
                                     authProviderConfiguration,
                                     Map.of()), authId);
                             }
@@ -1559,7 +1565,7 @@ public class CBEmbeddedSecurityController<T extends WebAuthApplication>
             if (smAuthStatus != SMAuthStatus.SUCCESS) {
                 switch (smAuthStatus) {
                     case IN_PROGRESS:
-                        return SMAuthInfo.inProgress(authId, redirectUrl, authData);
+                        return SMAuthInfo.inProgress(authId, signInLink, signOutLink, authData);
                     case ERROR:
                         return SMAuthInfo.error(authId, authError);
                     case EXPIRED: